The WooCommerce Designer Pro theme for WordPress contains a CWE-22 path traversal vulnerability that permits unauthenticated remote attackers to read arbitrary files on the hosting server. This occurs in all versions up to and including 1.9.28. The vulnerability enables disclosure of sensitive information such as database credentials by reading files like wp-config.php. The CVSS 3.1 base score is 8.6, reflecting high impact on confidentiality with no required privileges or user interaction. No patch or official remediation guidance is currently available.

Successful exploitation allows attackers to read arbitrary files on the server, potentially exposing sensitive information such as database credentials stored in wp-config.php. This can lead to further compromise of the WordPress installation or associated infrastructure. The vulnerability impacts confidentiality but does not affect integrity or availability directly. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to sensitive files via web server configuration or disabling the vulnerable theme. Monitor vendor channels for updates and apply patches promptly once available.